Malicious code in express-session-handler (npm)
The npm package express-session-handler version 2.3.3 contains malicious code that executes attacker-controlled JavaScript during module load. It performs an HTTPS fetch from a remote mutable JSON bin, extracts a field, and executes it using Function.constructor, enabling remote code execution in the Node.js process. The package disguises this behavior with unrelated code to appear legitimate.
AI Analysis
Technical Summary
The express-session-handler npm package (version 2.3.3) is a malicious package that, upon loading, unconditionally calls an initPlugin() function. This function fetches data from a remote HTTPS endpoint (https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92), parses the response, extracts the 'record.cerookie' field, and executes it as JavaScript code within the Node.js environment using Function.constructor. Because the remote JSON bin is mutable and controlled by the attacker, the executed code can be changed at any time, allowing dynamic remote code execution on any host that installs this package. The package attempts to disguise its true intent by including unrelated code such as a 'normalize-path' helper that is never used.
Potential Impact
This vulnerability allows an attacker to execute arbitrary JavaScript code remotely on any system that installs the affected version of the express-session-handler package. This can lead to full compromise of the Node.js process, potentially allowing data theft, system manipulation, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the express-session-handler package version 2.3.3 from their projects and avoid installing it. Verify dependencies to ensure this package is not included transitively. Monitor vendor advisories or trusted sources for updates or official fixes. Until a fix is available, do not use this package.
Malicious code in express-session-handler (npm)
Description
The npm package express-session-handler version 2.3.3 contains malicious code that executes attacker-controlled JavaScript during module load. It performs an HTTPS fetch from a remote mutable JSON bin, extracts a field, and executes it using Function.constructor, enabling remote code execution in the Node.js process. The package disguises this behavior with unrelated code to appear legitimate.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The express-session-handler npm package (version 2.3.3) is a malicious package that, upon loading, unconditionally calls an initPlugin() function. This function fetches data from a remote HTTPS endpoint (https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92), parses the response, extracts the 'record.cerookie' field, and executes it as JavaScript code within the Node.js environment using Function.constructor. Because the remote JSON bin is mutable and controlled by the attacker, the executed code can be changed at any time, allowing dynamic remote code execution on any host that installs this package. The package attempts to disguise its true intent by including unrelated code such as a 'normalize-path' helper that is never used.
Potential Impact
This vulnerability allows an attacker to execute arbitrary JavaScript code remotely on any system that installs the affected version of the express-session-handler package. This can lead to full compromise of the Node.js process, potentially allowing data theft, system manipulation, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the express-session-handler package version 2.3.3 from their projects and avoid installing it. Verify dependencies to ensure this package is not included transitively. Monitor vendor advisories or trusted sources for updates or official fixes. Until a fix is available, do not use this package.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14345
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a885f31acd9273b493f846a
Added to database: 08/21/2026, 14:22:41 UTC
Last enriched: 08/21/2026, 14:43:24 UTC
Last updated: 08/21/2026, 23:20:11 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.